<?php

// Provision a new dedicated QA database/role, using the existing local maintenance tool connection.
// No reads/migrations of business databases; no schema changes to existing SGF demonstrations.
$sgf=realpath(__DIR__.'/..'); $compras=realpath($sgf.'/../compras');
require $compras.'/vendor/autoload.php';
foreach (['APP_ENV'=>'budget-coordinator','DB_CONNECTION'=>'pgsql','CACHE_STORE'=>'array','SESSION_DRIVER'=>'array'] as $k=>$v) {putenv($k.'='.$v);$_ENV[$k]=$_SERVER[$k]=$v;}
$app=require $compras.'/bootstrap/app.php';$app->make(\Illuminate\Contracts\Console\Kernel::class)->bootstrap();
use Illuminate\Support\Facades\DB;
use Symfony\Component\Process\Process;
$proof=in_array('--proof',$argv,true)||in_array('--cleanup-proof',$argv,true);
$settingsFile='C:/laragon/data/sgf-tempo/secrets/'.($proof?'budget-proof.json':'budget-demo.json');
if(is_file($settingsFile)&&!in_array('--cleanup-proof',$argv,true)) {echo "Existing budget demonstration retained; no database, user or password replaced.\n";exit;}
$source=DB::connection('pgsql')->getConfig();
if(($source['host']??'')!=='127.0.0.1'||($source['driver']??'')!=='pgsql')throw new LogicException('Local maintenance connection required.');
config(['database.connections.budget_admin'=>[...$source,'database'=>'postgres','url'=>null]]);
$admin=DB::connection('budget_admin')->getPdo();
if(in_array('--cleanup-proof',$argv,true)) {
    if(!is_file($settingsFile)){echo "No disposable budget proof to clean.\n";exit;}
    $settings=json_decode(file_get_contents($settingsFile),true,32,JSON_THROW_ON_ERROR);
    $database=$settings['DB_DATABASE'];$role=$settings['DB_USERNAME'];
    if(!preg_match('/^budget_core_sgf_([a-f0-9]{12})$/D',$database,$match)||$role!=='budget_demo_'.$match[1]||$settings['APP_ENV']!=='budget-testing')throw new LogicException('Unsafe proof cleanup target.');
    $teamFile='C:/laragon/data/sgf-tempo/secrets/budget-demo.json';
    if(is_file($teamFile)&&json_decode(file_get_contents($teamFile),true,32,JSON_THROW_ON_ERROR)['DB_DATABASE']===$database)throw new LogicException('Team demonstration must never be a proof cleanup target.');
    $q=$admin->prepare('SELECT pg_terminate_backend(pid) FROM pg_stat_activity WHERE datname=? AND pid<>pg_backend_pid()');$q->execute([$database]);
    $admin->exec('DROP DATABASE "'.$database.'"');$admin->exec('DROP ROLE "'.$role.'"');
    unlink($settingsFile);$access='C:/laragon/data/sgf-tempo/secrets/budget-proof-access.json';if(is_file($access))unlink($access);
    echo "Disposable budget proof database/role removed; team demonstration preserved.\n";exit;
}
$suffix=bin2hex(random_bytes(6));$database='budget_core_sgf_'.$suffix;$role='budget_demo_'.$suffix;$password=bin2hex(random_bytes(32));
$roleCreated=false;$dbCreated=false;
try {
    $admin->exec('CREATE ROLE "'.$role.'" LOGIN NOSUPERUSER NOCREATEDB NOCREATEROLE PASSWORD '.$admin->quote($password));$roleCreated=true;
    $admin->exec('CREATE DATABASE "'.$database.'" OWNER "'.$role.'"');$dbCreated=true;
    $settings=['APP_ENV'=>'budget-testing','APP_DEBUG'=>'false','APP_KEY'=>'base64:'.base64_encode(random_bytes(32)),'APP_URL'=>'http://127.0.0.1:8003','DB_CONNECTION'=>'pgsql','DB_HOST'=>'127.0.0.1','DB_PORT'=>(string)$source['port'],'DB_DATABASE'=>$database,'DB_USERNAME'=>$role,'DB_PASSWORD'=>$password,'DB_URL'=>'','SESSION_DRIVER'=>'file','SESSION_COOKIE'=>'sgf_budget_demo','SESSION_FILES'=>$sgf.'/storage/framework/budget-demo/sessions','CACHE_STORE'=>'file','CACHE_FILE_PATH'=>$sgf.'/storage/framework/budget-demo/cache','CACHE_LOCK_PATH'=>$sgf.'/storage/framework/budget-demo/locks','QUEUE_CONNECTION'=>'sync','MAIL_MAILER'=>'array','BCRYPT_ROUNDS'=>'4'];
    $settings['BUDGET_DEMO_ACCESS_FILE']='C:/laragon/data/sgf-tempo/secrets/'.($proof?'budget-proof-access.json':'budget-demo-access.json');
    if($proof){
        $settings['SESSION_COOKIE']='sgf_budget_proof';
        foreach(['SESSION_FILES','CACHE_FILE_PATH','CACHE_LOCK_PATH'] as $k)$settings[$k]=str_replace('/budget-demo/','/budget-proof/',$settings[$k]);
    }
    foreach(['SESSION_FILES','CACHE_FILE_PATH','CACHE_LOCK_PATH'] as $k)if(!is_dir($settings[$k])&&!mkdir($settings[$k],0700,true))throw new RuntimeException('Cannot prepare isolated runtime directory.');
    $process=new Process(['C:/laragon/tools/sgf-tempo/php-8.4.27/php.exe',$sgf.'/scripts/budget-demo-seed.php'],$sgf,$settings);$process->setTimeout(60);$process->run();
    if(!$process->isSuccessful())throw new RuntimeException('Synthetic preparation failed: '.$process->getOutput().$process->getErrorOutput());
    if(file_put_contents($settingsFile,json_encode($settings,JSON_THROW_ON_ERROR),LOCK_EX)===false)throw new RuntimeException('Cannot save isolated server settings.');
    echo "Dedicated synthetic budget database and restricted QA role created. Four function accounts stored only in the protected local access file.\n";
} catch (\Throwable $e) {
    if($dbCreated){$q=$admin->prepare('SELECT pg_terminate_backend(pid) FROM pg_stat_activity WHERE datname=? AND pid<>pg_backend_pid()');$q->execute([$database]);$admin->exec('DROP DATABASE "'.$database.'"');}
    if($roleCreated)$admin->exec('DROP ROLE "'.$role.'"');
    throw $e;
}